CVE-2022-21122
Code Injection in metacalc
Résumé
Code Injection in metacalc
Description d'origine
La description telle que publiée par la source (souvent en anglais).
The package metacalc before 0.0.2 is vulnerable to Arbitrary Code Execution when it exposes JavaScript's Math class to the v8 context. As the Math class is exposed to user-land, it can be used to get access to JavaScript's Function constructor.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
npm
metacalc
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.2"}]}]
Références
- advisory nvd.nist.gov
- package github.com
- web github.com
- web github.com
- web snyk.io